1

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do some transfers to make the account or "test area" the more real possible? Should I ask for all the possible cards the bank has to do side channel attack testing?

I'm not a hacker nor I plan to do research I just want to know how would it be in real life.

1
  • 3
    You definitely don't want to be even toying with hacking into anything, especially bank, unless you're working for them or for someone who has a hive of lawyers in the same building that work for you and have confirmed that you're not going to spend time being a prison squeek toy for it.
    – user7933
    Apr 23, 2016 at 23:57

2 Answers 2

1

As far as I understood, the question is whether you would use your own, "real" account, a freshly created account or a test account provided by the bank.

From my experience, any company wants to limit the potential impact when doing penetration tests. Therefore, they probably won't be happy if you start attacking their production systems. Just imagine what would happen if some of the servers crash or hundreds of users are locked out of their accounts because you are bruteforcing usernames or alike.

If you want to do a penetration test, get the support of the institution and - if available - access to some testing environment. Yes, this won't be identical to the "real" system - but there is probably less danger for both of you. And you don't want do get in troubles, right? ;-)

1
  • AFAIK a correct penetration test has little risk of breaking things down, and some operations will necessarily use the production system, unless the bank explicitely asks you to do the test on a dev or backup system - I do not even imagine you can do that without a explicit contract for the test surface... Sep 23, 2016 at 7:41
0

What you are describing is penetration testing. Generally this is done when a company wants to test their security and get the opinion of a specialist in real world attacks. Other times penetration tests are actually required in order for a business to maintain specific certifications.

When a penetration test is done it's usually between a third party company, and includes a team of people running the test rather than one person. The two companies will agree on a scope of the test, including which areas are to be tested, which are to be avoided, the liability should anything go wrong on the test, etc.

No one person should ever be doing 'research' on a financial institution without this backing, legal agreements, and knowledge of what they're doing. If you tried to go this alone you could cause massive damage and would very likely violate several laws.

Look into penetration testing more. It's an entire career.

2
  • I did not explain well my question. I edited so now it says "If I would be required to do an ethic hacking research by a banking institution" I never meant to go rogue against some entity because science.
    – Vector
    Apr 24, 2016 at 0:44
  • 1
    Ok, well I think my answer still applies. It's basically an entire profession. If you google 'penetration testing' you'll see a lot of info about how different engagements are done, there's been several Defcon talks about the subject too. Here's one about real life penetration tests youtube.com/watch?v=Al53BulB0H0
    – Daisetsu
    Apr 24, 2016 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .